[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Another rkhunter question



Paulo Cavalcanti wrote:


On Sun, May 17, 2009 at 10:35 AM, Gene Heskett <gene heskett verizon net <mailto:gene heskett verizon net>> wrote:

    Greetings all;

    What is /dev/shm?

    I've given up on rkhunter ever shutting up about the group and
    passwd files,
    but fussing about this is new.
    ---------------------- Start Rootkit Hunter Scan ----------------------
    Warning: Suspicious file types found in /dev:
            /dev/shm/sem.ADBE_REL_root: data
            /dev/shm/sem.ADBE_WritePrefs_root: data
            /dev/shm/sem.ADBE_ReadPrefs_root: data

    And indeed, these files that I nuked friday are back:
    [root coyote linux-2.6.30-rc6]# ls -l /dev/shm
    total 24
    -r-------- 1 root root 67108904 2009-05-16 02:37 pulse-shm-3724332759
    -rw-rw-rw- 1 root root       16 2009-05-16 20:33 sem.ADBE_ReadPrefs_root
    -rw-rw-rw- 1 root root       16 2009-05-16 20:33 sem.ADBE_REL_root
    -rw-rw-rw- 1 root root       16 2009-05-16 20:33
    sem.ADBE_WritePrefs_root

Do you have some Adobe stuff installed? And might you ever accidentally have used it as root? Just looking at the name, I know you're old enough to know better. ;-)

    Anything with 'pulse' in its name has been nuked by an 'rpm -e', and I


You should have not, but it is your choice.
Is there a better way to get rid of PulseAudio? Some install option which prevents infecting the system in the first place?


    actually have working audio now, so can someone please explain this?
     A 67
    megabyte file in /dev for an shm device is for what purpose?

    I looked at it with mc's hex viewer, and the first 10 or so
    megabytes are all
    $00.  I got tired of standing on the page down key.


Just add these rules to /etc/rkhunter.conf, in the appropriate place:

 # Allow the specified files to be present in the /dev directory,
# and not regarded as suspicious. One file per line (use multiple
# ALLOWDEVFILE lines).
#
#ALLOWDEVFILE=/dev/abc
#ALLOWDEVFILE=/dev/shm/pulse-shm-*
# Adobe Reader (acroread) 9.x
ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_[a-zA-Z]*
ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_[a-zA-Z]*
ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_[a-zA-Z]*


--
Paulo Roma Cavalcanti
LCG - UFRJ



--
Bill Davidsen <davidsen tmr com>
  "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]